Jupyterhub/Jupyterlab make CORS preflight request to Shibboleth about jupyterhub

[welcome]

Thank you for opening your first issue in this project! Engagement like this is essential for open source projects! 🤗

If you haven't done so already, check out Jupyter's Code of Conduct. Also, please try to follow the issue template as it helps other other community members to contribute more effectively.

You can meet the other Jovyans by joining our Discourse forum. There is also an intro thread there where you can stop by and say Hi! 👋

Welcome to the Jupyter community! 🎉

[manics]

There's already an active discussion on this issue in https://discourse.jupyter.org/t/jupyterhub-try-to-make-preflight-request-to-shibboleth-idp/24853 so I'll close this to avoid duplication of effort.

[guyq1997]

Some Updates, incase others search for same question and land on this page. : )

I found a not-so-great way to solve it, and it only works in Firefox.

Jupyterhub runs in /jupyterhub subpage. In /jupyterhub shibboleth session is deactivated, it only needs the user data/http headers for identifying Users. This means that /jupyterhub is not protected by Shibboleth. Shibboleth Headers come from /secure subpage. /secure is for user login. As long as user is logged into /secure, the user data is stored in browser. Subpath /jupyterhub can therefore also read the user data/http headers.

The requests (to GET or PUT data into Single User Server) can therefore be sent directly to the single user server (Jupyterlab). Without sending to Shibboleth and check CORS premission first. However, this approach only works with Firefox.

Here is Apache Configuration:

<Location /secure>
AuthType shibboleth
ShibRequireSession On
Require valid-user
ShibUseHeaders On

<Location /jupyterhub>
RewriteEngine On
ProxyPreserveHost on
AuthType shibboleth
Require valid-user
ShibRequestSetting requireSession off
ShibUseHeaders On
ProxyPass http://jupyterhub:8000/jupyterhub
ProxyPassReverse http://jupyterhub:8000/jupyterhub

With Chrome, a 401 Unauthorized error occurs in Browser Log after spawning User Server.